Nueva variante de FAKE TOOL DATA RESTORE cazada por la heuristica del ELISTARA

Una nueva variante de este FAKE TOOL que oculta el contenido de todo el disco duro, ha sido detectado por el ELISTARA y pasado a analizar lo detectamos especificamente a partir del ELISTARA 24.02

El preanalisis del VirusTotal nos ofrece el siguiente informe:
File name: 1KALMIG2KB7FZP.EXE.Muestra EliStartPage v24.00
Submission date: 2011-10-05 16:39:33 (UTC)
Current status: finished
Result: 30 /43 (69.8%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.04.00 2011.10.04 Trojan/Win32.Jorik
AntiVir 7.11.15.132 2011.10.05 TR/Crypt.XPACK.Gen
Antiy-AVL 2.0.3.7 2011.10.05 –
Avast 6.0.1289.0 2011.10.05 Win32:Rootkit-gen [Rtk]
AVG 10.0.0.1190 2011.10.05 Downloader.Zlob.BDCE
BitDefender 7.2 2011.10.05 Gen:Variant.Kazy.39310
ByteHero 1.0.0.1 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.10.05 –
ClamAV 0.97.0.0 2011.10.05 –
Commtouch 5.3.2.6 2011.10.05 W32/FakeAlert.QK2.gen!Eldorado
Comodo 10352 2011.10.05 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.10.05 Trojan.Fakealert.25103
Emsisoft 5.1.0.11 2011.10.05 Trojan.Win32.Agent.AMN!A2
eSafe 7.0.17.0 2011.10.04 –
eTrust-Vet 36.1.8599 2011.10.05 –
F-Prot 4.6.2.117 2011.10.05 W32/FakeAlert.QK2.gen!Eldorado
F-Secure 9.0.16440.0 2011.10.05 Gen:Variant.Kazy.39310
Fortinet 4.3.370.0 2011.10.05 W32/Jorik.T!tr
GData 22 2011.10.05 Gen:Variant.Kazy.39310
Ikarus T3.1.1.107.0 2011.10.05 –
Jiangmin 13.0.900 2011.10.05 Trojan/Jorik.rvq
K7AntiVirus 9.114.5245 2011.10.05 Trojan
Kaspersky 9.0.0.837 2011.10.05 Trojan.Win32.Jorik.Fraud.eov
McAfee 5.400.0.1158 2011.10.05 Generic FakeAlert.ed
McAfee-GW-Edition 2010.1D 2011.10.05 Artemis!BB2777E53FCA
Microsoft 1.7702 2011.10.05 Trojan:Win32/FakeSysdef
NOD32 6519 2011.10.05 a variant of Win32/Kryptik.TNE
Norman 6.07.11 2011.10.05 W32/FakeAV.CD!genr
nProtect 2011-10-05.01 2011.10.05 Gen:Variant.Kazy.39310
Panda 10.0.3.5 2011.10.05 Trj/CI.A
PCTools 8.0.0.5 2011.10.05 Trojan.Gen
Prevx 3.0 2011.10.05 –
Rising 23.77.04.01 2011.09.30 –
Sophos 4.69.0 2011.10.05 Mal/FakeAV-OP
SUPERAntiSpyware 4.40.0.1006 2011.10.05 Trojan.Agent/Gen-RogueSoft
Symantec 20111.2.0.82 2011.10.05 Trojan.Gen.2
TheHacker 6.7.0.1.317 2011.10.05 –
TrendMicro 9.500.0.1008 2011.10.05 –
TrendMicro-HouseCall 9.500.0.1008 2011.10.05 –
VBA32 3.12.16.4 2011.10.05 –
VIPRE 10669 2011.10.05 Trojan.Win32.Jorik.Fraud.un (v)
ViRobot 2011.10.5.4703 2011.10.05 Trojan.Win32.Jorik.466432
VirusBuster 14.0.249.1 2011.10.05 –
Additional informationShow all
MD5   : bb2777e53fca769b7b17421270a43c5b
SHA1  : 96393f1f3ff58248643cb904ed337a4159b1624a
SHA256: 38fd393e3006caf503c62a0265da6681ecf8927fb0edde362448539e4b6745ce
ssdeep: 6144:RmW2vupwC3RzjG40j9jZziAi0e6kK7PwJVftWTa66x8t2JYb/mkcWg25mYaLrF7a:Rm14w
C3hGj1Re6kK0NWuxg2JU/HcU5m5
File size : 347136 bytes
First seen: 2011-10-04 11:02:26
Last seen : 2011-10-05 16:39:33
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: Daniel Pistelli
copyright….: (c) 2008 Daniel Pistelli. All rights reserved.
product……: Signature Explorer
description..: Signature Explorer
original name: Signature Explorer.exe
internal name: Signature Explorer.exe
file version.: 2.0.0.0

Dicha version del ELISTARA 24.02 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 5-10-2011